Who does what
Provider
- Run contracted SOC operations
- Maintain investigation cases
- Validate detections and respond
Your team
- Maintain access and contacts
- Make infrastructure changes
- Own wider remediation
Details
Service scope
Best for Organisations outsourcing daily SOC work while retaining infrastructure administration and business incident decisions
The operating model matters
This profile covers fully managed operations. Components in the order set coverage. Joint and platform-only variants differ.
Containment has agreed boundaries
Playbooks govern routine response. Severe threats can permit analyst containment, with your team involved in wider remediation.
Operations include detection upkeep
The SOC maintains cases and validates detections. Customers retain access, policy-change and recommendation duties.
Full service analysis
e2e-assure's fully managed SOC runs monitoring, investigations, threat hunting and detection improvement for the service components you contract, using its Cumulo platform. Your team maintains access and escalation contacts, implements required infrastructure changes and works with the SOC on remediation beyond its permitted response actions.
- Your team owns
- Maintain tool access, permissions and escalation contacts
- Implement required configuration and policy changes
- Coordinate wider remediation and recovery
The operating model matters
The service can be fully managed, jointly operated or supplied as a SOC platform. This profile covers the fully managed option. The components in your order determine the data sources, hunting depth, validation work and response capabilities included.
Containment has agreed boundaries
Predefined responses and approval-based playbooks depend on connected tools and permissions. The definition also allows analyst action against an immediate severe threat without a pre-agreed playbook. Your team remains involved in infrastructure remediation and onward incident response.
Operations include detection upkeep
Analysts manage cases and investigation records, while service reviews and detection validation check coverage over time. Customers must maintain access, make required policy changes and follow security recommendations for the service commitments to remain valid.
Pricing & contract
- Billing
- Tiered, Custom
Pricing depends on service components, monitored assets, operating model and onboarding. Procurement bands for older protective-monitoring packages and separate Microsoft endpoint offers should not be treated as a complete quote for the current Cumulo-based SOC.
Tradeoffs & buying questions
Strengths
-
Offers a defined fully managed SOC operating model
-
Connects investigations with detection validation
Considerations
-
Coverage depends on separately selected service components
-
Customer configuration and remediation duties remain
-
Exit data migration may require paid assistance
Ask before buying
- Which service components and recurring SOC tasks are included, and is our contract fully managed or jointly operated?
- Which responses run automatically, which need approval and when may an analyst contain a severe threat without a pre-agreed playbook?
- What are the total onboarding, asset, consumption and export charges, and who retains detection content when the service ends?
Integrations
Platform / SIEM
- Cumulo
- Microsoft Sentinel
Other integrations
- Microsoft Teams SOC Channel app
Common questions
Can we keep our existing security products?
The service integrates existing tools through supported log sources and APIs. Confirm each product, license and response permission during scoping. An integration does not automatically include every available response action.